Sciweavers

Share
NDSS
2015
IEEE

vfGuard: Strict Protection for Virtual Function Calls in COTS C++ Binaries

3 years 6 months ago
vfGuard: Strict Protection for Virtual Function Calls in COTS C++ Binaries
Abstract—Control-Flow Integrity (CFI) is an important security property that needs to be enforced to prevent controlflow hijacking attacks. Recent attacks have demonstrated that existing CFI protections for COTS binaries are too permissive, and vulnerable to sophisticated code reusing attacks. Accounting for control flow restrictions imposed at higher levels of semantics is key to increasing CFI precision. In this paper, we aim to provide more stringent protection for virtual function calls in COTS C++ binaries by recovering C++ level semantics. To achieve this goal, we recover C++ semantics, including VTables and virtual callsites. With the extracted C++ semantics, we construct a sound CFI policy and further improve the policy precision by devising two filters, namely “Nested Call Filter” and “Calling Convention Filter”. We implement a prototype system called vfGuard, and evaluate its accuracy, precision, effectiveness, coverage and performance overhead against a test set...
Aravind Prakash, Xunchao Hu, Heng Yin
Added 15 Apr 2016
Updated 15 Apr 2016
Type Journal
Year 2015
Where NDSS
Authors Aravind Prakash, Xunchao Hu, Heng Yin
Comments (0)
books